security - 身份验证入口点 Spring Boot 2

Question

我正在尝试在我的 WebSecurityConfig 配置方法中在 Spring Boot 2 中实现自定义 AuthenticationEntryPoint。

我见过很多这样的例子:

@Component
public class Http401UnauthorizedEntryPoint implements AuthenticationEntryPoint {

private final Logger log = LoggerFactory.getLogger(Http401UnauthorizedEntryPoint.class);

/**
 * Always returns a 401 error code to the client.
 */
@Override
public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException arg2) throws IOException,
        ServletException {

    log.debug("Pre-authenticated entry point called. Rejecting access");
    response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Access Denied");
}
}

但我总是得到 403 而不是 401。

如何在 Spring Boot 2 中做到这一点？

Answer 1

在这里看看我的回答:https://stackoverflow.com/a/52986942/3437868在这里:https://stackoverflow.com/a/52986779/3437868

简而言之:从 Spring Boot 2 开始，类 Http401AuthenticationEntryPoint 已被删除(请参阅 Spring Boot Issue 10725)。

使用带有 HttpStatus.UNAUTHORIZED 的 HttpStatusEntryPoint 而不是 Http401AuthenticationEntryPoint:

http.exceptionHandling()
    .authenticationEntryPoint(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED));